Loading story…
Abbott Laboratories is investigating two cybersecurity incidents after extortion actors claimed access to company-related systems and data. Abbott confirmed unauthorized access to limited internal legacy Exact Sciences systems within its Cancer Diagnostics business after ShinyHunters listed the company on its leak site, while a separate actor, ShadowByt3$, claimed to have breached Abbott's third-party-hosted LabCentral customer portal using compromised customer credentials. Abbott said the Exact Sciences-related incident was limited in scope and did not affect operations, manufacturing, lab operations, patient service, or other Abbott businesses, and it said the LabCentral portal contains only public technical reference materials rather than sensitive customer or business data.
ShinyHunters alleged it carried out a mid-June vishing attack against Abbott employees, compromised a Microsoft Entra SSO account, and exfiltrated data from multiple connected systems, including customer and medical information, before issuing an extortion deadline and threatening to leak the data. Separate reporting identified Exact Sciences, described as Abbott-owned and operating in the U.S. healthcare sector, as the victim named on the ransomware gang's site. Abbott said it is probing both matters, and as of the latest reporting, neither ShinyHunters nor ShadowByt3$ had publicly released the allegedly stolen data.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
Abbott said it notified law enforcement, activated incident response procedures, and brought in external cybersecurity experts as it investigated the two cyber incidents affecting its diagnostics-related systems. The company also said the incidents were isolated from core infrastructure and had not disrupted operations.
Abbott confirmed unauthorized access to limited internal legacy Exact Sciences systems within its Cancer Diagnostics business after ShinyHunters listed the company on its leak site. Abbott said the incident was limited in scope and had not affected operations, manufacturing, lab operations, patient service, or other Abbott businesses.
ShinyHunters claimed it used a mid-June vishing attack against Abbott employees to compromise a Microsoft Entra SSO account and exfiltrate data from multiple connected systems, including customer and medical information. BleepingComputer noted these claims were not independently verified.
Abbott disclosed on July 16, 2026 that it was investigating unauthorized access to a limited environment tied to its Cancer Diagnostics business. The company said it was assessing the scope and impact of the incident.
Exact Sciences Corporation was listed by ShinyHunters as the victim of a ransomware-related data breach, with the gang claiming data had been exfiltrated and threatening public leakage if the victim did not make contact by July 18, 2026. The notice was characterized as a final warning.
ShadowByt3$ claimed it accessed Abbott's LabCentral customer portal on July 4, 2026 using compromised customer credentials and stole product-related documents. Abbott said the third-party-hosted portal contains only public technical reference materials and no sensitive customer or business data.
After the July 2026 extortion attempt, ShinyHunters later published data it claimed to have stolen from Exact Sciences' cancer diagnostics business. The exposed dataset reportedly included 10.9 million email addresses plus names, addresses, phone numbers, and health records, and Abbott said some impacted files contained personal information and/or personal health information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
13 references tracked. Mallory keeps watching after this page renders.
haveibeenpwned.com
Open sourcecybersecuritynews.com
Open sourceteiss.co.uk
Open sourcemalware.news
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceabbott.com
Open sourcehookphish.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Healthcare and pharmaceutical distributor McKesson disclosed that unauthorized actors accessed certain third-party applications and exfiltrated data affecting a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. The incident was linked to a purported ShinyHunters “pay or leak” extortion campaign, in which the group allegedly published data after McKesson did not pay. The published dataset reportedly contains **6.4 million unique email addresses** alongside personal and corporate information involving marketing recipients, patients, employees, and healthcare-provider contacts. McKesson said it had reasonable assurance that unauthorized activity was no longer ongoing, while affected organizations should assess potential phishing, credential-stuffing, and impersonation risk arising from the exposed contact data.
Sep 16, 2026
ShinyHunters, a financially motivated data-theft and extortion group active since 2020, has continued targeting organizations across entertainment, healthcare, education, and criminal infrastructure. Rockstar Games confirmed that attackers accessed a limited amount of non-material company information through a third-party cloud provider, while maintaining that players and operations were unaffected. In a separate September campaign, data allegedly stolen from Swiss medical-device maker Medela was publicly released after a “pay or leak” extortion attempt; the dataset reportedly included roughly 424,000 unique email addresses, corporate contact details, and some support tickets. The group has also claimed attacks against other cybercriminals: it allegedly exploited `CVE-2026-42608`, an unauthenticated path-traversal flaw in Grav CMS, to compromise and deface Clop’s former Tor leak-site server and demand payment. Grav released version 1.7.53.4 after the issue, which had previously been fixed only in the 2.0 branch. Reporting also links ShinyHunters to the theft of more than one billion Salesforce-customer records in 2025 and disruption of the Canvas learning platform in 2026, underscoring how repeated data exposures can be combined into identity profiles that enable account takeover, fraud, and targeted scams.
Sep 30, 2026
ShinyHunters has broadened its operations from data theft into a wider cloud-focused extortion campaign targeting enterprise SaaS and identity platforms, with reported intrusions involving **Okta**, **Salesforce**, cloud management systems, and CI/CD environments. Public reporting links the group to phishing, **vishing**, brute-force activity, exploitation of internet-facing applications including `CVE-2021-35587` and the Oracle PeopleSoft zero-day `CVE-2026-35273`, abuse of OAuth tokens, and theft of assets such as BrowserStack API keys that could enable supply-chain compromise. Researchers also reported insider recruitment efforts aimed at personnel with access to Okta, Microsoft SSO, Citrix VPN, GitHub, and GitLab, while the group allegedly uses leak sites and services such as LimeWire to pressure victims into seven-figure payments or sell stolen datasets. The FBI separately warned that ShinyHunters claimed responsibility for a disruptive attack on an online Learning Management System used by educational institutions and students across the United States, underscoring the group’s reach beyond traditional enterprise victims. According to the alert, the actors specialize in large-scale breaches and extortion and may follow intrusions with extortion emails, threatening texts, phone calls, impersonation, spearphishing, and even swatting, sometimes falsely claiming to hold compromising material. MITRE and industry reporting also associate ShinyHunters with aliases including **UNC6240** and **Bling Libra**, ties to **The Com** and overlaps with **Scattered Spider**, and note signs the group may be moving toward ransomware through a reported `shinysp1d3r` platform with ESXi encryption capability.
Aug 10, 2026